MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 035e10a18589289d2a4e28a95e0b70964de4f88fb649fc8175c14e0dd36972fe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 035e10a18589289d2a4e28a95e0b70964de4f88fb649fc8175c14e0dd36972fe
SHA3-384 hash: ee9a08448a571015ada1e68e43e167957a842b22c61d449552442f7726543229527d22a2703f957f33e58bec9032ead0
SHA1 hash: d03c8efc3edd9338205f9a67e6dd5b74c2ba0ea1
MD5 hash: 6caa34796f300c87747df72675363796
humanhash: golf-green-helium-september
File name:130003150.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:338'388 bytes
First seen:2020-08-07 13:12:28 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:2d3dZjaGXhNM8heR23I/4RfmXBL4MH5OzgOvbv5ue/0JWXClEe9+8Si5T:yjvXhN3P5qUMZOzxlue/OpkFi5
TLSH 6874236A46FC8E31C44FDFC0AD49E322CA3008E7EB729636D9337E6108951252599B6B
Reporter abuse_ch
Tags:DHL FormBook zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: dhl.com
Sending IP: 37.49.224.193
From: DHL Express Service <no-reply@dhl.com>
Subject: DHL Shipment Prealert Arrival Notification victim-email
Attachment: 130003150.zip (contains "130003150.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Fareit-FVT28A761904CD7.25468.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/035e10a18589289d2a4e28a95e0b70964de4f88fb649fc8175c14e0dd36972fe/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-07 13:14:07 UTC
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=anpbbimfreuj2ksofcuv4c3qszg6j6epwze7zalvyfha3u3jol7a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/035e10a18589289d2a4e28a95e0b70964de4f88fb649fc8175c14e0dd36972fe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 035e10a18589289d2a4e28a95e0b70964de4f88fb649fc8175c14e0dd36972fe

(this sample)

Formbook

Executable exe b3349406861e76bfb84f4757a646c3fe94eb5e1cd27abeeffa48aabb6c8fa4d5

  
Dropping
MD5 28a761904cd7842e2bd18886de2fd374
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b3349406861e76bfb84f4757a646c3fe94eb5e1cd27abeeffa48aabb6c8fa4d5

Comments